Configure automatic account management
Verified with Windows 11 25H2 — updated on July 12, 2026
Supported on: At least Microsoft Windows 10 or later
Path in the GPO console
Computer Configuration\Administrative Templates\System\LAPS Description
This policy configures automatic account management policy options. Specify the target account to manage: specifies whether the built-in admin account or a custom account should be managed. Automatic account name (or name prefix): specifies the name, or name prefix, to use for the managed account. If this policy setting is configured, Windows LAPS will use it as the account name or name prefix for the target account. If this policy setting is not configured, Windows LAPS will use "WLapsAdmin" as the account name or name prefix. Note: this name is treated as a prefix when account name randomization is configured, see comments below. Enable the managed account: specifies whether the managed account should be enabled or not. If this policy setting is configured, Windows LAPS will enable the specified managed account. If this policy setting is not configured, Windows LAPS will disable the specified managed account. Note: Windows LAPS will regularly maintain and rotate the password of the managed account regardless of whether the account is maintained in an enabled\disabled status. Randomize the name of the managed account: specifies whether the name of the managed account should be randomized with a random numeric suffix. If this policy setting is configured, Windows LAPS will add an eight digit random numeric suffix to the managed automatic account name, and will re-randomize the name of the managed account every time the password is rotated. If this policy setting is not configured, Windows LAPS will use the managed automatic account name as configured. If the managed automatic account name prefix is configured, Windows LAPS will use up to the first twelve (12) characters of that name as a prefix for the random name. If the managed automatic account name is not configured, Windows LAPS will use "WLapsAdmin" as the name prefix. Note: the DSRM account on domain controllers cannot be configured for automatic account management. This policy has no effect on domain controllers and will be ignored even if configured for a DC. See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
Registry
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS Value name: AutomaticAccountManagementEnabled
Enabled: AutomaticAccountManagementEnabled = 1
Disabled: AutomaticAccountManagementEnabled = 0
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure automatic account management
; State: Enabled
; Supported on: At least Microsoft Windows 10 or later
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS]
"AutomaticAccountManagementEnabled"=dword:00000001
"AutomaticAccountManagementTarget"=dword:00000000
"AutomaticAccountManagementNameOrPrefix"=""
"AutomaticAccountManagementEnableAccount"=dword:00000000
"AutomaticAccountManagementRandomizeName"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure automatic account management
# State: Enabled
# Supported on: At least Microsoft Windows 10 or later
$path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementEnabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementTarget' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementNameOrPrefix' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementEnableAccount' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementRandomizeName' -Value 0 -Type DWordIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure automatic account management
# State: Enabled
# Supported on: At least Microsoft Windows 10 or later
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'AutomaticAccountManagementEnabled' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'AutomaticAccountManagementTarget' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'AutomaticAccountManagementNameOrPrefix' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'AutomaticAccountManagementEnableAccount' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'AutomaticAccountManagementRandomizeName' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure automatic account management
# State: Enabled
# Supported on: At least Microsoft Windows 10 or later
$path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementEnabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementTarget' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementNameOrPrefix' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementEnableAccount' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementRandomizeName' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Configure automatic account management
# State: Enabled
# Supported on: At least Microsoft Windows 10 or later
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure automatic account management
# State: Enabled
# Supported on: At least Microsoft Windows 10 or later
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'AutomaticAccountManagementEnabled' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'AutomaticAccountManagementTarget' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'AutomaticAccountManagementNameOrPrefix' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'AutomaticAccountManagementEnableAccount' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'AutomaticAccountManagementRandomizeName' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure automatic account management
# State: Enabled
# Supported on: At least Microsoft Windows 10 or later
$path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementEnabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementTarget' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementNameOrPrefix' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementEnableAccount' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AutomaticAccountManagementRandomizeName' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.